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JiBSTRACE 


The FrcofohetVier Afi el hear let V: ally crieiltei -.eriputor pro- 
gran for checking waihsmtltB: prc-cf&, with the ohedicing of te*t- 
fccc’rf prooffl &9 i-F- ultimate goal* it &ot:e :raot; , fr*ra ea ''h P- otJi 
siep fivan to if a ooet* spotting sequence of formal Ftepej If 
pc a.si bite. It rtK-OT-aia the current ttete of the proof in the fern 
si vitat ;t i£ sufficient to prove. Ther'e are two ^ogioai r - i - l£ ' E c± 
iflfsremss TBoUn p^ews ana inflation (if it if sufficient to 
prove P. ana a if a theorem, then it iff sufficient to prove A 
iii..p:defl P)m The perui ef'ible formal pfapEt include thee* rules of 
inference as well as provision for handling definitions # lesimas, 
calotiatiosis * and reversion fc previous stater. As of now, me&t 
of the formalisna ar^ progrfinf-iPfti and part'Tally debugged, but the 
heuristic aspect? ha’s yet tc b# program:el* 
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?*J»?0S5 AND FHilQSvFHtf 


\ proofchecker is a computer program which checks hh themat! cal 
proofs to sea if* they are correct* A m the svafc leal procf la & syrn- 
bo T .1f ftYprcesiorjj. arid an can be used as input date, for a computer 
program written in a symbol-manipulating language* Wow If a 
proposed proof has been s iFfic.lently formalized. It een bo cheeked 
by & simple s^t of rv.lesj but IF the proof is of the sort that 
appears In most mathematics textbooks s the checking procedure ffijot 
be txt falsely elaborate and even then cannot be guaranteed to work 
all the time. The a hi no; textbook proofs is the ultimate goal, of 
&ne Fro of checker project,. even though It probably will not be 
reached* -his go&i Mil tot the dirts tiers of the Ere effort &; how 
fac they go ren^'ras to be seen* Sane programs have already been 
ch-ddd out; eany remain to be written,. An of this writing, two 
el^atetifcftry .Formal pi^jofs have been cheeked. 

A number of the ideas pr* so is ^ed *n this psper arose from 
a _Lgge jit Ions isade by JJohn McCarthy: holriever, the views expressed 
he ca are not necessarily in agre e nen t vri, tbs McC&rthy 1 s H 

There are two difficulties that arise in devising a procedure 
for checking textbook proofs. First, the proofs are written In 
English: second, they are ambiguous, informal, and full of gaps* 

1 am not at present planning to deal with the first problem? though 
it is interesting, it irrelevant to the main purpose of the 
FroofchecU^- project.. Therefore, a will assume that the proofs 
which 1 would like the proof checker fco examine will be presented 
In a fora&liaed and stylised language, but one which makes no 
attempt? to clarify the logical defects of the English original 
from which they are taken* The FrooFcheoker will have to correct 
these defects and chock the resulting formal proof at the same time* 
Essentially f the Proofchooser works by taking each step that 
It i? given &nd generating fro-r it a sequence Of formal steps- c 
Thus the proof given to it really Servea a S&t Of hints on how 
to construst a formal proof of the theorem at hand. The FrooF- 
^hoclcor must be something of a proof inventor, for it must anohg 
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, other things be able to handle stops labelled as ,: obviou£ [t t As 
the capabilities of the ?roofth£cksr increase, it will got better 
anti toot tor at proving new theorems., In fart, we nay view the job 
of the- Proof checker to be to Invent proofs, given a eet of hints: 

J.n the two extreme cases r tbc hints are either norcesd stent or are 
all the Eitepa of a f ohp&'I ised proof. 

l.'e may corridor the problem fro; it the viewpoint c T checking 
methods for generating proofs, i*e,, seeing if a proposed method 
of proof generation gcnegates a proof of a desired theorem. The 
two viewpoints are equivalent; fyr a technique which will utilise 
Mnts is eimply a proof gen era tor with an inputs Pur the r, the 
Proofed-toe? i.rist be able to nia'cs uee of information on that the 
(ceDbsra of a ces'-ain class of symbolic expressions are legitimate 
proof p * Such a place of inforration is a ire t a theorem. In order 
for any proof-checking system to liMlica roe t&theoreras, they mu&t 
too built into its structure^ in the Proofchecker, met a the or eras 
siay be added without changing s ha overall pattern of operaticn^ 
S9rantiuMy r they are added to the list of permissible proof steps, 
&o thay they act like additional rules inf trance (which, indeed, 

they are J + 

Tha ^.urlstic Ap proach aiid Hel&t ed Work 

The Proofchcckar will raalce extensive v.&e of heuristic methods 
and techniques L Thie is nereeaary because a straightforward search 
through ?-he space of connections between sue sea Give hints would in- 
vo.i v* &n impossibly lar;. amount of computation =. fne scheme which 
H hope will be useful h?ce Will toe the K Oer.&rol Problem Solving 
Sy?ten. [> of Newell and f .ue rn This system has already been used in 
solving problems in trjgohonstry T elenient^ry algebra, and logic^ 

The chief feature of ',ne system la ita separation of problem content 
from problem-eolving technique* It makes use of two principal 
heuristics: uieanF-ECjtJB analysis, which involves knowing what 
irsthoda of attack ai? appropriate to particular situations, and 
planning, which invoices consideration Of an Abstraction Of the 



problflED hand.. Closely related to the tiarming heuristic j& th^ 
heuristic of mode}.? as uf.ed by Qelornfcer. ^hla heuristic, for the 
case of plans goe mt ry r involves drawing figures and cheeking theia 
to pee what relationships hold btttfee?) various line seerrant .■? r 
angles, etc. 

There if 4 repeal an'& between the role of hints in the 
Proof checks a? a;r*d the redo of' advice itt McCarthy r e Advice Talcs r 
ackerne* In each cape, we went a traohlne to wake use of pieces. of 
Information £iven to it "Torj an csterna' source in order to solve 
a problem In the case of. the Proof c hecksr* the g tincture of the 
^advice Jr tfakco it rauch euaJer to rtetermine how to use it„ 

Pr oblem fe n a Ins 

The Froofo he otter will not bo tied to hny particular area of 
ma'-bei.iatl os f although I e;rpe*t to work mainly on abstract algebra 
at. firefcfl The Proofch.a.'ker, llh.e the inathflicaMclfin„ is lnfcendel 
to be a general-purpose device.. For e. given problem dotiain, it 
will have relevant tS'.ecreJap, heuristics, and tiodel-raafeinc user ha- 
nl fc, stored ir. its memory* Actually* It would be useful If the 
Proofs hacker could be aw^re of the ttleorcEiis. it had ever 

prove I r though It ml^ht have leer ready access to those from 
different domains, The difficulty here is that thera alrnp]y 
isn : t enough rooc; in the ooir.putcirj as things aland n^i, for the 
additional theoreus. 

One poeslble araa of application.. though admittedly soisswhat 
futuristic, is to Cht 2 checkout of iarpe gyetarcs* The present way 
that one checks e-uc3i a system to fee if it works is to present it 
tilth a wide varle.ty of Inputs representing. both typical and ektrsne 
oaesd^ and see if the proper output results* However, It often 
happens that this method simply dcc&n't work; the system falls 
under sonso unanticipated combination of clrcuuaatantss which never 
occurred In the test -3a? ec*, One way t? chert: gut such a system, 
however* is to prove that it isorlrsn Such a proof A of course, would 
he Impossible for a human to Construct for a system of even raild 



SO lip laxity; bill: 5 rIlv hirte nifht be tbls to sons trust suoh a proof, 
■jfvlrig as h<n;s the description of the funolions and Intended rao3e 
of operations of ^ariouE- components ari subcomponents of the 
And in a proof attempt, on* might c-cti? up sith a 
;(j.nierexampie ar.d possibly eve?i su^ge^t e remdy^ 



C-'WAEfEATJON OF THS PROOFCKECKER 

The Proofchecker is orgunlssd 'nfco two constellations of 
programs ? Method and Vivify. &> iition to the data internal 

to these progpiic.is., there ie n 'Lis? of theorems, a Ugt of defi¬ 
nitions* and a list of Isgitirjnta proaV .*Up?, TtK theorem list 
and definition Jiat may be auscranteci with time*. Verify will 
accept a proposed fortral proof step and determine if it is correct > r 
if feha stop is correct. Verify will do the necessary updating of 
the state of the universe, tiethod will determine xhat the next 
step should be; it will male 2 use of the hints given as input In 
finding this step. The steps which Verify frill accept must be in 
standardized form; thus, all of the JiOurl&tidB aro Sh the province 
cf Method, though Verify will band !2 updating in such £ way as to 
make the use of heurirticE e^py. 

The current state of the proof is recorded in the form of 
what it is sufficient to prove v V.<= will call this expression th$ 
sufficiency, i,e., at oach at&g<& it is sufficient to prove the 
sufficiency* Tucn initially, the suffi&i&my is the theorem ;;a 
wish to prove; arc. when the sufficiency hss teen reduced to T 
(truth), we know v& have proved the theorem. We may record the 
frufflciercy at various stages- of the proof and refer hack to it 
later, ac that if we conduct an unsuccessful aubprcblem exploration^ 
we can return to an earlier subprcblera without having to repeat the 
initial stops of tha proof* 

This particular foiw of recording the current situation 3s con¬ 
venient because of the- wide variety of logical structures which may 
appear in a theorem or in its proof* To use a Hot of hypotheses 
£.ud conclusions would be awkward, for instance, in handling an if- 
and-only-If theorem, unless It were to be broken down into two 
separate theorem* * Yet Euch theorems p,rs often proved by a sequence 
of hi conditionals, and this natural sequence can be retained In the 
sufficiency for moration of the proof* Purthermope, this formulation 
makes backwards proofs quite easy to handle, and they ere perhaps 
the aoct nature 1 kind* At the same time, it\_in possible by u?ing 
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Certain logical tautcjl05i.ee to make forv/ard proofs; find the 
machinery for handling such proofs oan be built into Hcrthod in 
auch a wsy that tins utter need not be aware of the few complications 
that this entails„ 

T he Theorem list 

The Proofchecker ie endowed with an initial got of theorems 
which are placed on a tllecren Hat* and encli newly proved theorem 
ie added to this 15 at, Lemmas proved during the course of proving 
a theorem are also added to this list. Whenever a theorem la 
referred to in a proof, Jt. is brought to the head of the tdiscrem 
list, so that frequently used theorems are can fly accessible* 

Each theorem consists of a name, a list of variables* and a 
form* Whenever the theorem is used in a proofs it is referred to 
by name; t 3 va variables doBignats those elements in the fern which 
may he substituted for* We may think of the variables as 
designating universal quantifiera which implicitly precede the 
form so £9 to concert It to a theorem in the ordinary sense D The 
form is the actual statement of the theorem; r.o inherent res trl-fc ions 
are placed upon its formsfc, though for any problem domain, the 
format will be specified. 

The Definition LUt 

The Proofchecker aloe h&e available to it s list of definitions, 
A proof may be interrupted at any point to wake a new definition* 

A definition is sjmoly an abbreviation* with provision for sub¬ 
stituting for certain variable3 within it* Each definition consists 
of two names, a ]jgt of variables, and a form* The re ference name 
J.a U&ed when we refer to the d^flnj tlon lr. a pr-oof sfc.?p, and Ch$ 
Internal is. the one actually recorded in the sufficiency and 

in any theorems or tho theorem list in which the definition la 
used* The form ard variables operate ir* the 6ante way as the fore 
and variable? in £ theorem* Definitions, like t-heorems, are 
arranged ao that recently used definitions appear at the head 
tho list. 
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rh.-i Need for Two tfan *2 5 


ife need two names in e. dofj nltJ.on because etherulae we wa,y 
accidentally assign to 6 . definition a reference nz.-ae which a?.ready 
lias a meaning; and then iy leaking uao of the definition, we may 
mke e false htep which vrill pase ■':' o\„ ftr. v-ellidIo will 

illustrate ttv? danger* Suppose Ron that we h&ve only one name 
ae^hoiatbd with a definition* let uc define &*m with varieties 
X and Y as {HOT, (OR, X,Y 3 }» Thus akd is the (X y} it the 

llrfc of varieties, and (HOT, ■ OR f A t Y)) dr tho for fa, -£ow 15 appose 
ftiw*t ue have as theorem (KCT, (cr, T, T) 1 „ Then the theorem is 
'he orlg.lnal sufficiency. £y using the definition, ve may then 
g£X &*• sufficiency (AtlD, T, T); and by other ms ana we may reduce 
? h; 5 to Thu? vr won Id have £01.15 how prevented froi'ii entering the 
A]?l> into the sufficiency i): the above example, wc- would not have 
been sblo to carry out the proof. If an internal naira, say GOOOIj, 
h at. beer entered .1 r. p" isc of AMD, we would have had so aufficiency 
(GfiOOp, t\ T)j which would bo improvable ainre GODOjj hao no Vw:m 


pre-pet t i t?s □ 

In genoral, wo u.-.t- the reference name when we refer to £j defi¬ 
nition in a. proof, but the internal name ie the one actually records 
in the sufficiency. The Verify program handles ttis 'substitution of 
■;h£ internal name for the: reference naras automatirally, Tlra in¬ 
ternal rdrir; ic £ newly ^onerated symbol which crijj be guaranteed not 
to have b^an used for anything before; the program which creates 
turh symbols in 1"SF -Is c.fijlel Gsnsym, The symbols it gftiaerates fire 
of the form Gxjc":, wharu tha 7's a?o decimal digits 4 


Rcd^fln^ t ion 

It Is possible to redefine a term c/cr, though it has previously 
been de-fSncd, Itfhcn wo cic till3 1 howav-er, wo lost the ability to 
loafer to the previous definition. This 1 e because i-?hsr. search 
the definition II rt for the reference trams, wa will always cooie to 
trie I&tar definition and we can access a definition in a 

proof st5p only through its- reference name, This is as one would 
^ike it to baj for It permits -i£ to-make teTnporary definitions 
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of term? without prenludift^; tho later ni=e of thti^e teroffi for othnr 
purposes. The Interna; 1 , naiTisc of the successive definitions will 
remain tniiue^ ?o there ia no danger of ronf isloni 

Froseryfitl on of gjr'tajpj-^gLjl: gma 

Often, in a heuniat to proof, we 1 wilJ make efccps which, rfhile 
correct:, don ; t help to prove the theorem, Slr±ee sash steps may 
actually lead us to a ni tuition where the sufficiency la a fal¬ 
sity (ahd hohte unprovat le)„ we fiiuet have e ray to go bp ok to 
previous suffla3enoirs At the same tlue, we ijQ.i’t i^ant to keep 
all previous tuff :l clone-it* r because it may talcs op too iaioh rocn 
Therefore t there are fcv;o ways in which wo cay .save past 
sufficiencies... 


Ra wer tlr.fl 

When We Hfike a sstop, wo may request that the last sufficiency 
be preserved ( V'o iray g'.in S-^cags to :l t by reverting one or more 
times ; depend ins o n how far along ve havt Lioved & jbfcSOJiontly <. 

There Ie a parameter... pot by Method, which tells Verify whether 
or not to preserve tbs most recent enffL.-isr-.iy. 

The list, of rr e^ oT vcd ihifry rob lem i 

The revert lug pro&<?dnr& is not alienate when wa wish to bank 
up several steps,, move c.ff in another direction, a]id then, after 
the rew exploration provep feasible, return to whjre tjo started. 

It le inadequate b&A&VtiU ths starting point dies On a different 
branch of the exploration tree, 7n order to handle fchia, there 
is pic vision for riflining the current sufficiency at &fly time find 
storing It on a list of aubprcblecrs to ba preserved. At any point,, 
we my raattaek it If we We Kay also remove any aafflclsniy 

from the list of preserved 0 utproblems* The Items on the li.pt of 
preserved subprobl-eats ere then aooessed by their muss . When tha 
theorem at hand ht& betn proved, the list o? preserved subpt obiorcJ’ 
If eutCBaticBlly uiesrud. 



Proof SiregK and Tfc^lr £££££££& 

Each type of prior step lg i^tpr^revd by a program >;hiHr. 
tp-kep the parameters or the step as ?r.put., updated uh&tsver needs 
to ba updated, a^d g.-v£:$ at output T or 1'. depe^iin^; on &'!;■*<her 
or not ':ha proof siep is cornet. tfctatJ - msy be ieiearpov&tid 

into the system if they £re Sd-£ Up a& proof Etepaj ordinarily* 
they will take the auff.'.oJeney as input, test it or ?. gutejf- 


prseai.on ef 
in actuay L 


t for a ps:- i 3 prcpt: ty, and then tr Ena for!? i X- 

3 ? o2nst ati£e, a Ic&i-s, L eir.sj.llf:’.ia.tier pr ogr&&. 1J 


torrKspond to & rostafchsoFemj rush a progvir* weald reduce the 
sufficiency to a tor logi^H; equivalent- form,, The 

eotdfiJ i:;at&theTcruirt be thit 3-hs result of tlnplific&tion <;•: 
in a very r,p,se lo^j oaily ooyiv^lat.t to 'hi original forra. 


The Ver.-.fy Pj^ocrnsiii 

Thu Verify oro^rati lf? ye have pointoi out, chtetai eao.h 
suc-3tssive ft£p of the proof* and perfo-rhit varLous kind? of up-' 
dating., Bcfot^ eite.eeinLsig. any steps t it ee^ gns internal narosE t o 
all the variables ?o fis to r-ver- a ton flic t r- t:J th pra^icjsly e. 3 ?l£j%ed 
UK an? ngs: 4 ^hoi-curter 4 whmi variables! arc referred’to by their 

Verify replPasn i;5>.?e n£.Pi9i trich lha internal uanies in the 
eteps* oi' the proof, Tnue mist; hod need no: even be a^ara of the 
existence of thete Internal niir-es. Variii al®o a sit® the sdfficibilw 
initially to be the thsoreyj wt wish to preva; when the theorem has 
UcEH proved. Verify places it at the head L-f the theorem lief, 
Vi/Mfy repeatedly calls on rfcthsd to prod*, ,-e a proof etap, £$ch 
proof s!‘ep in i Mica ted by the n-s^s of a program and a. set of £_r ga¬ 
rs. r<t£ for tht.t piso^p&ii, t Verify chachp thf. tho pr&srsia navis is on 
the list of legitiifafe proof step?,, ar/i. il &o f operates the pro- 
gram. ?ha result indi antes whether or net the step wan correct; 
the proof &tep program ’aandlee tl:e upuatin^ that tus&ds t-o be done .• 
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7113 Method ari 

Wet hoi \p- called upon repeatedly by Verify tc furnish proof 
Dtepa. While Verify will probably reinaln unchanged ag the Proof- 
checker is piadiFi«<i, Method tin be highly ; s -abject to ehangs. 

Wet hod us as heuristic raothods, In genial, to determine what the 
nest proof step should bs r At pr-ssenfc, Method aitiply leads the . 
input directly tc Verify, but this J.s only J.n order tc cheek out 
verify* As vror-k progresses* Kathod will befogs acre and aore 
elaborate, 

One possible is&y of elaborating Method is to do to Morar- 
ohif;oilj'. Rather than rcurlti Method to account for now improve- 
dents t a new lfetfco-1 would be written which uses the ojd one as a 
subprogram* This technique is well sdapbed to heuristic programs.. 

R ole of notion f -.lb:j 3 :prcr L s Long 

In sues as civs sufficiencies^ thare will often be large sub¬ 
expressions which are carried along intact anil are therefore 
Identicelc The Proofchecker has been organised eo aa to have both 
sufficient it a refer tc fchs samo r opy of such a subexpression^ In 
general, copying Is avoided sis much as possible, saving storage 
and cimu* 

This might appear to be marfely a pracisioal prograuweing device, 
tut it has Eua interacting counterpart In tsi^-boctc sytheTiatlcfl t 
Essentially, common s aba i^praae ions act like prono.ins; thny are 
useful ir. the ear.e way that ifc Is useful in a book to write an 
equation, number It, ana later oil refer tc it by number.. If we 
did not use the numbering technique or its equivalent, we would 
have to write the equation out In fun whenever we wanted to refer 
to it* 



LOGICAL FOUffDmCWS OF THE PHQOrcHECKER 


j'rri fls I fasorlptron 

We will Ft fir t with £ olaes of p^.va for t = 1,5, 

which we shall call t heorems * K&eii is a symbolic e> - 

preEfclonj earh it a Eet of atomic symbols *■* ^in." 


Va refer 
V yrat.t_4« 15. 
fii'eptioitr 
“ fl ' ' J it 


to T H a: 1 the form of the theorem &P *1 to * heoi^j as the 

of the I.hsorsr^ If ... , Jt k are symbolic ex- 

, then the result of rote titling for otj ^ ,dg for , 
force, in t\„ is a fheovetr, tratanoe„ Note that the T* 

jijHj a ——,„™ ■-- □ 


ere theorem, instances by the 3 <2 sntity substitution, 

A propert y !^s e 1Sl a:: s^oaiic symbol which Is used solely 

as: a variable in it t hearer, and for no other purpose, For instance 
AlJh and PSfitf£ wo aid not be propcrtyless ty.nbole,. In LI5F, the 
function QEKSYM in used tc or~a^e these symbols, 

Ice be a symbolic expression, and. t*'appoi L o that there exists 
a ftarjucnpe of sentences S- f 5 ? , *,, # f-uch that S^-i ^ s i '■- “ " l 

2 ., n) and S R is tfve symbol t! T r . (The meaning of ^ will be 

explained shortly; T represents truth*) isf. , & m be a 

sot of proper tyl^?£ symbols, find do no to this set by Then the 
P".:r i£ a -i:eore r iU F'jrtharnrcr-e* the Initial the ore as are 

theory'* The eld’s of tbeoiwe IE thjs fenced recursively, 
starting with the initial theorems* 

We denote *3 is a theorem inptano& r by .- S* and ir it If 
sufficient to prove £ r ty H 5. The logical aye tern is bfiRtd on 4 wc 
rule:’ of Inference; 


1. if hT and -f & r then H (insertion rule) 

2 , If and -fS l , then H?, (Modus ponens) 
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inkuifciv&JVj £? ■*- ~j S 'D i?-' - Formally We £ay 

£ — S‘ if and only if 

L 3 5 iu of i-'b-i! fo? i> T J ,3 end T t Cr 
? v j- 5 1 or 

3, S J 1e oM fiirwd fro'n S by stub* ‘■'itutinjj for eoerte subex- 
prasr Jon of 5 the eq^lvrAent o" that scab expressions provide that 
the eubexpression is not pa.l cf £ .juuted ftulraxfjrsEEioiu 

Eajf v£j snt e,ita*ijrc e p Ions arc- of t v j type $ i 

__ m* r m -si m marfc — , ■?- i . , — 


1 * ft defined term la squlvslarst to that which 5i define a* 
f * ftn ey pron & * on i.diiei> represena t hi r a e a± t of a calcularion 
If eqtiVitliint to the result ilrelf. fhe calc jlati on Ip parforitid 
h;r evs.l*it fciiig the ejrpr&jrion c^i than replying J :- by the ^ucted 
result of the evaluation. 

For instance, 

fBUE!ST t (Q'.WI'E* Uu P)), J.W'-E, (^.IC^’S, (FCNB, P r fcJJ) 


i?ctild be equivalent. to 

[ jfVFE* JCCiia, f ? 4 r ft : E) ) ). 

Here fciffltfT is a L‘£SI J function which a jl'* tit urea its first argmiianb 
for It r eecond armament :ln it a third argument r 

Th? definition of — 5 s changed when mfcfcatheorstsB are .adted to 
%ho system Ther,in n ora l :he above description corresponds to the 
systeia are it now at&rdg, but in not p= 5 r^r.or .5 r 


Eols of I ni ti =_J T.jeore^l. 

'■’hue Initial tlieoreits differ froot £_x loros as we think of them 
in thnfc for Host precise. detains there is no effort to make t-hem 
noil-redundant. By using a pyp-lem Kilt; a lar^e Initial endMMant, 
interesting result ft ars rapy bed mere cuiokly. It i? true that aj.1 
L:ajhe ratic-S may i>a conEt'i’uated from lower predicate calculus 
with :-i.y-jJ L ity; tus tin? working cath.Mte.fcic Ian dees not ordinarily 
Tiake ic>£ of tuj 3 fast, even though he Is ftvare of it* This is as 
t-r.ie *or topo^ogigus and algebraicisU it. it r or hydrodynamic lets, 
ani rt-imeeiaal snalyc tg, evej: though the i z rm?i- way ov ;aaicnally five 
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'■■h z Par of thi s -i-— T ' ^ e 

Ih per rr.i11:Tn£| t'.:e o * ii c tij at i or v■.il e, we bave 1 & t t he wls.I f in 
fSoors IJs woiy.i lilt. i th* Pro^f ohaoVrer, when £c\ven ?. proof’, to 
te guaranteed l:o give u a verdict. ■hivjovtr, vj-isti vjo introduce 
the calcination v.iae, to cea. nv Icjiv-or g^rar/ceo this, except at 
iZi’c at: coi-t * FOr ;5hen v.* tc lor t lu-f.-c g nt express ion of the sufficiency 
and proceed to cn;. o.ulet i it - vsim, the Ionia tiers way rot ter- 

t:. it ate.' i'urtfcaruorci, l J :.r In n) ^pr>f-ib\e to protest t.he 

sut farpreadion to cos :hciK-jr or /.of 1'ha aal-ulatltn fill r zrt tfild 
f Y. sone i;orse arid deitrx- Frnr-fj'h^frksr program or noSify it*: 
contents {a funtasErica:!1* :lever- leur-nir^ pz-cgpw. f for 
aiojiht ieurn to chaat by iKdi -'yi« s T i' 5 * 3 pi ra^.-srers of' the Proof - 
rhsrSter no a? to force it to ncecr' : fairs f^epeL' -fcos& pr-oUews*. 
nay he solved Vy uiuini^'- all ca/.aa] at-iois steps or an interpret tvs 
bat ?$ r but this re qui r e ? a p r J -■*. t e a r .-3 ■iiii.te e i a 1 ? or at e inter r r ei s r 
fc ] ■ t h e >r a of <ihc c i L ir; f Q-.'t i j?r cior 6, it ttou j d be viVra ci at V y 15. r^e - 
■•: os is? ut. 12 , n.r b ec a up e i^e..; t '. r. c-1 ann.; ir.rr-.-s pr o &r&if at 1.1 o £J hipber- 
*? ?j propr■ oui d [if:ve bo he itttarprsted 

"his difficulty is :txi died Vy placing all calcolations wider 
the control v a program cqH^I Errorcet- Err^aet nausea mc-at. 
love:led 3rrer*E >uj /.on-' ■ ?r-,L-: Jlntiona to return to con- 

► r ,;X to * ho Proof chtc^^r. It w j 1 i not cafnh all sul:V. errors j ao 
this ioslaftl ioop!:gle doo- reiSbilh- Kevmvs}’, defective proofs whi.rh 
do pet ty Ertorsct i-!il ardinar31^ ciX‘Se the ?»&of«h£-clc%r to stop 
ra' her -. \E.fr r.o £ falf-e an^vor 
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■ ciy 

,w^ r 


tfhen Verify m** g lr«:=. a proof ,n qjj fron ft:. ’ V.c-d f it oherk? tc 
ses if jttae step is of on@ 0 ? tha raiepnlEeb; typos, and has the 
approbate ratto.i’ o' os asacrerr v^i b it If i-or r rhe step is 
erransoue* if i.feue are iset, tl-e tiiir*e of the i.fep :_£• 

of ^ he c ■■ e p e.u 
•-■ho jorro - 
.rra;f e.ftii _,. ii 
:ieci by Verity, 
t: !be , J .r ure- 

f^i.lra?Ts ;,-.a pr J mi r in at- or- bul : rtlnf; -bleu its is cottat]*•-•,* .ifsf rhe - '.rpo s 
of ptspp we 1 ere really 3 i»i\* ratted in. they are noi *i.M uttfa. 1 . by 
f-.hawf!a'! ves , t‘"vove_- ? >;h j ;- ixi gix ipr &r.C t-erci in id with r*er L :a1 r 

s poo t'f J f ■: he r. rejr e , tb ey ba-joi •£ il? i " e {>$ ■■ It z f til. 


tseen afi 

V be r.Ltre 

of a ■•"'jnfb.i 

ar|?nT5i.-:nt? 

of tl at 

fui-eti on . 

?p. uAl 

f tno *■ i orj 

i/;he-. 7 1 k the 

l*f -h -*% .■■*#■■ 

Ss 1 -- 1 T¥‘ 

tho neue n 

.r-ery JiylJtt 

The 

typo? of 

prf.rf '.i L" Ji}i si 


l i is f c; l o w! j j ■? r t e-p ? a ro a. ai; a t>? a - j: 

V" rt «(6 t *1 

-'. .1 , - I I - V - 

t'iiti h-c a-= pa.Taf'12 -ere ‘he naiss of a theor-ets. 

and a 15 ei f P fUb is 1 t v■:■ io«?.. TI o r .m vec::-omij'xgt fur. 1 f o a 

finds U e tb£Ote;fi on ! he the*, ren ?.d c - b, per forma. \ htr J, 
irdi..:3U:i r,■•?,!>rli t m'. ft--. f nd 4 .: .-■ ■ i fepp\S c <. t he J rjr &i - if:n 
r -j ie be- the t « il c t '. h ^ ora - ir.ai. «n: o an i :bs '.u-rr en "■ 

r uff i-j -;.f■ t -v ,. f tho n■} irjd rht-oi tn " s r,o^ c n r ho t h? srert 
iftt, f r ' f t h >• v ariai-kSs ; n t he- e li bn ,t f t L . j, or. 11 : t do 
not corffc■ > , jC'.“ d ' o bo /ar*.abj.e;.. cf !b.o t"beotc”, the st ep 
is reboot el* 

t! „ J'tpC lH 

* u ] .:,= £*:sp iiE^ s- 1 pa' fti. 1 ! *!.crr bhc. haiiO of e intv-rnr? 

rne c t- c-frp'. n i: np ramn ich flrd^ the t-heoreis on tbs 

Ihooxom i;. 5i, !etf:3 !BiS-i3 kht pi’flf t -lt..j t i t Jl iOTJS for 

the Vai cf U.s and fha.i applies tJi& rule 

of rave** s n-ndf;p zonr-n* 1 . J . o re idlt ;.n^ t heorem ar rf tVa 


...!» ;•<: T.\ f if 2" 1 r . eT-.L~-> l 


i ■ -L 


:-: x^ti '.,111 t>e re Tec. !-*(? 


1 ** 


the 
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0^- re-IT- ■ n 


■|. 1' 


rn : 1 e 1 ie:;i 


j.ini 


r j' if i lie ih£'n"f 
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Is not of the for.i f in-.e-i; edent t con#efi 4 £iit)' + or 

Zf the suTTIcie r,-;r i* nor; a a iihk hi tuition Instance of the* 
c che e qii£ n t wi i S r j r, p £•-:■ t r c : :,r vari at;ies o f fc hi? i he ore if, . 

C rIj juate 

This stop b&s bm arg-iMiifc a il*t cr a 1 s arid D 5 a ithisfc 
1ndi^ate the a:ii 3K.prerrs.1 on of the i- sift’' ;1 cpc.y whete vsiue 
is to te calo^’atsl . IT the a.:.Ft her. no elements, the 
EybejrprPSBlcri Is. the entire entpreasion. The- rtep rspUS’vos 
the fubeiprer^ion * ty L;.ht i'i-'XTK ; e- al?/ ; ■. The s?,ep 
wijl L?e 1 ejected If the a 3 it rochet ;s?i at or, Ir; symbol or 
a queried eipre; filer coftye It I;: c-Tcha^y led. 

Lerja 

I hie st*p hit &:■ or jr^jent f> a ^p-k, a J it l of vari&l le.i* 
end □ fern. In thf =1 ,= : :ep T the Troof^hsokeT 1 In 
recur fit-rely "n chm - the proof cf i. Jen'.n’.a. .rJ: I tei-ipc- 
rar'Iv neglecting L.tie inair, theorem, IlT rhe ipm-^a is 
proven ; it le added tr t he thsorcr, lint; In {nj :,£.?$ T io:.- 
t-rol J ;: ret ime?: fcr Mvs proof of '.he Jtaln theorop; whfrf 
either the prover, cr- t h^ Ppoof^ti&o^e-r is. tsid \r 

give yp ^0 ?\, 

Hakedc f 

Tht? step hi?, a*, arguments a rtauue, a list of variable*, 
and a fern. Tt c- porrs'fording fon-Glion first aselgng. an 
Interna nE;, 7 ? !• o be tho 0 luivslon; of the reforanc© n&ire. 

It then p'ia.ies the 4. 1 e t which convainu host nait,eK^ the 
variablen-.n-i rhe '■'ci’iT at t re teg*nn',njj of tho Ir.it Lon 

litt. 

Uae-de f 

Thi:;. s^op ar pc.ranater^; a r.£T? aiid a Ulct 0^ A - s 

an* D'liu Tho A l fi F^nd r■ si are us ed to Ifiileate a aut-ei- 
pro? a ion of tr.& F.yf f j cl er*'. v 1 t.he narae ta the reftrcriGe 
narje- of a defsnl.ttor,. The aorrezponding ^ jn^tltn geps 

;! e Jeflr.iti on from ■ he 4 ? .1 *-; c 1 li«L a-*, i che.^^ t-h« 
y-ite*7ir-vf.sicri to fpb if i. :Sa a L>alr:-sii dtlon In^Fsof 
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the for!,i cf thtr definition., It. 1 it replaces the sufc- 
espre 3 stem by sl list ^0:ie first in the Infauna- 

name- of the definition^ Th« r-er^ ininj elements he ire the 
property that if they art?- saV-iched eeqjenvtally with the 
^riabli-et of -lo d^fini'Iiion ami r iiatitute.1 for the te 
variable5 i"i the forrr, Ue result in. the original 


sufcsjtproision.. 

Und e ft no 

Thf.P s-top has a?: pErcraeter a l.'at of f t and f a 
tdhloh indioata & Bubaxprftssion of ihe tuffi^ien-jy, The 
first Planter.' of this auLe^posB'iiort la SaV:e ft as the in¬ 


ternal name of a definition* arvl the definihioh lict la 
f. eai' c he 1 fe r ihE t n s iv e - A s ut 5 \ i ■; j 11 j n i 1 c-1; i 3 f o ra»c. 

by nat^hiUE thf- fucces^ive a Usman tc of bhe subexpreosl cm 
with ’r-fie variable" cf the definition., pro them the 
indieated submit at.ions ars perfcris^-d on tho forra of the 
definition. Finally* the a ui fibres*! on 1 r placed by 
t he re u u 11 of 1 his, ^ ufc a V 1 t no ion. 1 lie- s tep i g re ,t&q to d 
if the named definition i 1 * not or, the definition list, 
nr if the n.^aht-r of elanents t'oll&wln^ internal name 
of She la f inittort in the * iberpr-e^ion is’not aqual to 
t he n ar.il .or ( j f \ a r 1 at le.; c V the ?. j'ooj: pr£ a a le n . 


;Jg:T:.i-p"o 

?h:’t- rep !ja= at 4 iara nd ‘. st a rfiforon-e name. J L 
lau^F- j t. pair tftre* fJrrt* clu-rat-t is. the r.a.ae and whess 
necend ele^nb i£ the iurr*n sufficiency to te plao^d on 
the liet- of pro served £ 0> pro h lot.rt. The zW rent BtfffitiPhsy 
«'12 lie able to te roretoi e J if nsi e^St'.ry at & l-abar ti ti;v. 


Rea ttii '-dfr 

T : n h.t£ -9. hop ha?: a; 5 , pi! a me tat the r.a^e of a p ;tproblem 
on the list of prisoned uutprot lers, jl" nausea the 
currant jvafficl&nay to te :*e? to- the- auffiaienoy paired 



V-'I.K L ]-C : •• '•?: ii ••• on V'" fiVC'i-vcri r . ] .r ■■■:■ \r. :.v 

ttep Ij: rt-jattorl If the jnanse doi-e net eorraspcjyl to a 
nc.!i3 qjtj rha \izt- of prs?E i.vvatl suhpToMeraa., 

Klllprab 

This sbep har- &t- pa car,re ter the nz.ii;? of a problem or 
the list of pi^ie^ved £iu : .-proi..lem5 v Tt: causes that sub- 
problem ts be deleted frer- the IIet ¥ 
no thin g 

"hia sten has me *vcrsj oters, and has m efftot 

whittle eve j\ 


Revert 

?hf ? r.l ep ha? rio pai r a:.L "ar£ . It cuufe--i as to take 
the s&oosl no£t recent e uff' t J er.i y a^ the Oirrert 
sufficiency, J f the current ;Vj? f iiiettcy if the thaor-iff* 
vre wish to prove, the step If.-, rejected, "Jrrlesa the Pkrrcnv 
e’jffic-eirty ir --ivM by h ns!nepr>- ? a revert tv 3 11 S' 

to bo lost. 


QtvJ 


t’b.ie ;*s ep hir nr parausrs-rK . if the 4jrrsn 
ic. ’"T 3 L'-O plaoe the thaoreri at the hvafl of the 
liBti &r;d Verily wiii return 'rtith ir, uh£»^r of 
eufflolenoy 3 f r^t T r the S".ep is rejected* 


t atff iriancy 
t he Ofern 
If thfe 


f|T 

l_l B 



swaaE'C GTr-rcs FOTUEf: plans 

ft? of this wrltirjfh the Verify prog.bf.tf, if* In the process of 
debase? ng- ani the Me bto-l predraft J.r. m n.f. met r-ullgiaritary .fcj-tft* 
Method merely fskes a list of stepf, pe^Iiii Lhero off one by one, 

3 tri pa ? £. £■$• them to Ve rl fy, uh J 1 e pr i. 1 1 i I r,g uj 1 ; u: ’ e f ,i 1 inf or^a t X o n c 
'Ihb program has been cod£-l ^htirely in lISP* which aoeraa to te 
ifcftS 1 sviUd to i.hw apj^ 1 ( 5 ai-ton , j.t. part 5 o ji.'ar, lie Lendl*03 of 
o e rcjro n s Mb e *pr e f * * onr without ■ rat: s;. e r ? ary d up Hear 1 on wi 11 pr cb rX 1 
safe the Pt e-ray e c± \ Xf I, ait it ? u t l ■; i tie r&l. - ly wh on : he p j ob le m 5 ga t 
icore ce implicated and ths ft he orr.v and. definition He to £12 ti longer. 
jt have alreeiy writ-01; a 13. ths functions which ah.e ,:.k mv; differn ni. 


Ftep^j though scae of 1 iien are in reed cf revision. 


out 

It 


After Verify a: i 5 t 
.1 p^an no werif or. 1 
o ttrtraol augahra*. 


s t-x' a Hit. e fkinciionf have teen cheeked 
ffipt-ovins Methodj at the sao? time apply Tn^; 
Ky firrzi, ciec w ill be to Incorporate 


ma^ro^s tep-a which 11M.I ccrf.hL several individual 3 Cepe alons vii n. 
specific tbeorens % Un>. t !i rhv;lll build in cachir.ury v.bfch allohi 
the steps to be ebLie a;:'' iyuo isly : ;.' ver—-for inactive, fc v «s g'.h- 
h tit ut Iona Ttifth?. he omitted r'a:’ j ! s of ter; done In S hs citation of a 
theorem, in a tej.tfcot.k proofJ L After that, I shall investigate 
u3 rt ,ous learr>: r-£ Berber is si *' -h roi g hi; h a ii»--orpjr*ted- Kcw0vei-, 
if. difficult to tvthi rlpstf at t-Lis point juat what course the 
project will folios the piano at ea*h stage will b<? inflt»no-sd 
Ebron^Iy ty the ro-'ultr of the preceding stage. 



